From 5d93f6b23b1cb15995545122918216819243a231 Mon Sep 17 00:00:00 2001 From: Thiruvadi Rajaraman Date: Sat, 4 Nov 2017 07:53:26 -0700 Subject: curl: Security fix for CVE-2016-8619 Affected versions: curl 7.3 to and including 7.50.3 Not affected versions: curl < 7.3 and curl >= 7.51.0 (From OE-Core rev: 3b97fc78d9cfee6586f3d55f04f20f72fd1af8dd) Signed-off-by: Thiruvadi Rajaraman Signed-off-by: Armin Kuster Signed-off-by: Richard Purdie --- meta/recipes-support/curl/curl/CVE-2016-8619.patch | 56 ++++++++++++++++++++++ meta/recipes-support/curl/curl_7.50.1.bb | 1 + 2 files changed, 57 insertions(+) create mode 100644 meta/recipes-support/curl/curl/CVE-2016-8619.patch (limited to 'meta') diff --git a/meta/recipes-support/curl/curl/CVE-2016-8619.patch b/meta/recipes-support/curl/curl/CVE-2016-8619.patch new file mode 100644 index 0000000000..2c8f0599b2 --- /dev/null +++ b/meta/recipes-support/curl/curl/CVE-2016-8619.patch @@ -0,0 +1,56 @@ +From 91239f7040b1f026d4d15765e7e3f58e92e93761 Mon Sep 17 00:00:00 2001 +From: Daniel Stenberg +Date: Wed, 28 Sep 2016 12:56:02 +0200 +Subject: [PATCH] krb5: avoid realloc(0) + +If the requested size is zero, bail out with error instead of doing a +realloc() that would cause a double-free: realloc(0) acts as a free() +and then there's a second free in the cleanup path. + +CVE-2016-8619 + +Bug: https://curl.haxx.se/docs/adv_20161102E.html +Reported-by: Cure53 + +Upstream-Status: Backport +https://curl.haxx.se/CVE-2016-8619.patch +CVE: CVE-2016-8619 +Signed-off-by: Thiruvadi Rajaraman + +--- + lib/security.c | 9 ++++++--- + 1 file changed, 6 insertions(+), 3 deletions(-) + +diff --git a/lib/security.c b/lib/security.c +index a268d4a..4cef8f8 100644 +--- a/lib/security.c ++++ b/lib/security.c +@@ -190,19 +190,22 @@ socket_write(struct connectdata *conn, curl_socket_t fd, const void *to, + static CURLcode read_data(struct connectdata *conn, + curl_socket_t fd, + struct krb5buffer *buf) + { + int len; +- void* tmp; ++ void *tmp = NULL; + CURLcode result; + + result = socket_read(fd, &len, sizeof(len)); + if(result) + return result; + +- len = ntohl(len); +- tmp = realloc(buf->data, len); ++ if(len) { ++ /* only realloc if there was a length */ ++ len = ntohl(len); ++ tmp = realloc(buf->data, len); ++ } + if(tmp == NULL) + return CURLE_OUT_OF_MEMORY; + + buf->data = tmp; + result = socket_read(fd, buf->data, len); +-- +2.9.3 + diff --git a/meta/recipes-support/curl/curl_7.50.1.bb b/meta/recipes-support/curl/curl_7.50.1.bb index 5c63996df1..544110134c 100644 --- a/meta/recipes-support/curl/curl_7.50.1.bb +++ b/meta/recipes-support/curl/curl_7.50.1.bb @@ -15,6 +15,7 @@ SRC_URI = "http://curl.haxx.se/download/curl-${PV}.tar.bz2 \ SRC_URI += " file://configure_ac.patch \ file://CVE-2016-8615.patch \ file://CVE-2016-8618.patch \ + file://CVE-2016-8619.patch \ " SRC_URI[md5sum] = "015f6a0217ca6f2c5442ca406476920b" -- cgit v1.2.3-54-g00ecf